https://signal.org/
Use this for communication.
Verify the codes strictly in-person after the app was installed on both sides. Read details on their website.
It's hard to tell without having physical access to the device whether it's compromised or not (it's hard to tell even when you do have physical access).
I recommended Signal ease your paranoia. If you want to be extra sure and have the means to do it: never hurts to switch to a brand new phone either.